stealc | 90c0c3077c8a1174b97f404fb39e8519a678e104d3cd79b3653de0169b3b7c74

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260922-rtpmravwfs
SHA256 90c0c3077c8a1174b97f404fb39e8519a678e104d3cd79b3653de0169b3b7c74
MD5 256cd09ed8fd748fbf5887aa78fd4f56
SHA1 84ee16b918948a1e38efe2a0f2c2b858794de37a
SHA512 afd1d5fb3181277b45a38ca082cfc15c7e7caffbe3fa3b55612c9be00b9d000e0d29faf59721d918e6152d39148d44f49c3946df067920d558bd9ee9370ef87f
SSDEEP 49152:8wlhO9jlOb9hP65baFY3Xemz1joiEq0bOySQIxcB8Q/sASaQeNTlGSaXN/j2U4FH:nc9bES/+zbij2jF
TLSH
T124267B1BE2B941F4C0B6D1798A979617FAB27819973297CB0291475B1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/5848-31-0x0000000140000000-0x000000014047E000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5104	elevation_service.exe
2076	maintenanceservice.exe
1888	elevation_service.exe
6028	OSE.EXE
4780	PerceptionSimulationService.exe
3076	perfhost.exe
956	ReFsDedupSvc.exe
5960	SensorDataService.exe
4676	ssh-agent.exe
5428	AgentService.exe
2592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b3efb7a7c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086bbeacf9e4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb5700ce9e4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5848	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5104	elevation_service.exe
Token: SeBackupPrivilege	956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	956	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5428	AgentService.exe
Token: 33	2592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2592	SearchIndexer.exe
Token: SeDebugPrivilege	5104	elevation_service.exe
Token: SeDebugPrivilege	1888	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 2424	5848	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 2592 wrote to memory of 856	2592	SearchIndexer.exe	102
PID 2592 wrote to memory of 4776	2592	SearchIndexer.exe	103
PID 2592 wrote to memory of 3156	2592	SearchIndexer.exe	104
PID 2592 wrote to memory of 3340	2592	SearchIndexer.exe	105
PID 2592 wrote to memory of 2472	2592	SearchIndexer.exe	107
PID 2592 wrote to memory of 2704	2592	SearchIndexer.exe	108
PID 2592 wrote to memory of 2748	2592	SearchIndexer.exe	109

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5848
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5848" "1460" "1332" "1448" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:2424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3076

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 70793b56b50c81aa009a9c009331b415053dcc1a688ddda247f667d4a06d4b6f
MD5 4516ca5e6a1d380aed0d8f6afac98943
SHA1 8aa755c8b4805622d27c0bd12f8416bfe0a54369
SHA512 a6ffa0661b4526709a610906c3ce5cd3f0cda98e2e84bf57e9ef760d9db1d794b0183bdc9d1f377b8510687227f0a22cb13d946b487f64ea635c0f92eab54657
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4N/j2U4FH:23q6HjB9j2jF
TLSH
T1FAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4fa1bfd98ca5182e61420f0c98bf347f925feb709588d5eae9ea41314ac3a0b6
MD5 bf8c38afbcdd378b4ea1ab54c12ae3db
SHA1 f648e89c587fbe21ccdf54972caac258e9254bb9
SHA512 a4e69d7b8d99deba5c224cb85a7465d6bae1fcd53aed65e16a5569cc92aade6373cbcd06ff2676ccab2132cd0180b44cea4cbccaf428600958d5259b119f1f02
SSDEEP 12288:B1XLsswWkxy2lRq2czA+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vXYfDtczAydCN/j2GLl3iFSE33b9
TLSH
T1B8050128B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 aebc0438f9426e32b10d59b06f1d2c259518e06380c306d721c9db7daa3b4e2d
MD5 f5a145e586f8d0689bdc51e9e3a951c4
SHA1 d044f7b8957044f192266084e9447dc5826dcff6
SHA512 f585a8ce10aac6084634c8c3dc01bbca1cce34cbe521ecc7d0ecee8cca4b85925d652cce8f70fa0c86e7253e0068f1c43c776e12469e03e5c36790a852fb23ee
SSDEEP 24576:r0Le5ji0hmxirMJdCN/j2GLl3iFSE33b9:rPji0AcXN/j2U4FH
TLSH
T1DF35AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dbe92aba21023e9a6f10da2fcc57eabecb55ecf20c5ea2b11459e55a415d668a
MD5 a4f3e423474d1d383f4f6b5b2f338bde
SHA1 9d47b7b5f9e2c4fb782c6f94e32155597135fe9f
SHA512 e7586e9b9cc5535c8ee68b5bed085713e603095108addb69d50ca6106cb48ecbcd60bb0d8842fb8385f61a4911911e6beda2b6f8c19d0722e0f03415ba51b905
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuPdCN/j2GLl3iFSE33b9:P/ezSC6vUzPvxHjy7N/j2U4FH
TLSH
T1D5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b3ffec437a5f9773609f30292d7f93871af49eeb0d54a7ea7b232af165201cba
MD5 f5011567440f06ce08eea4a94538216a
SHA1 609601f87252c47e56b97e25f565923cfa489a02
SHA512 fb3997bc103ac5b81fa1f9ea45e9776d526a89ee9f2c3b6f096a6b3381784da2e67297f7d8de76387b53b868e8de3e8a5d2aa89cc2e3fc1e46738b074a0d0f59
SSDEEP 24576:YVbqPb88hv/l+6+dCN/j2GLl3iFSE33b9:YVO88hXl+yN/j2U4FH
TLSH
T17F559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b16e636b3661cfb6ceb53d171d75d3faad0f79135d7e7a492220c3858d263dc3
MD5 3d35737c256c97006bc89053dd0eceb8
SHA1 62a3054b304b1d72303ca765f67918c40014bdd7
SHA512 a9c7013d09145d008ac0ba6e0cdce480ab46f957f86d5351d9adc35a80218318b0b3d37e20be255b49fde1b4c8cee5430da43e146c461efc10820e110347735a
SSDEEP 12288:dRRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dRldCN/j2GLl3iFSE33b9
TLSH
T1A5C42364DAA5F665F26F837903ADAE655200FEE8E525884781817BEF513CFECC032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9253dba8722aadd0783d582ae2a6d957b1971ec93cbbff6eef389d095701906a
MD5 90c37bc99d1d38fe860b4279676c3d99
SHA1 43383ba51a1520c1a515de8a089a581a8d300216
SHA512 ae94fef105493383a6ed3c441de010f42f70c029a96b742367c5610baaa1aa208e7951b7259c82cdaeb6bb2c8db9757b8ba1231405484e71ede0359c29cd199c
SSDEEP 12288:xeBNUbTVO86UqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xJIUWdCN/j2GLl3iFSE33b9
TLSH
T1F705CF3BEE28FCE2C27E8DB85791C600976278708B6293CBD165834EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c58717c94fe2f4c57a03896105ad6e3d823a78cac1c4663564594b8ce9448a8d
MD5 847f0e20fc5e54825bc524bd206d7da7
SHA1 67fcdc614941420d1ec8c276ac3bc0d3e0da09bf
SHA512 fdc2aebcbd484199ab91bf1919c1bdc2f747f596ef8292724801487c059244cdec222957603c585186a4c9740b4dd16a36d92318030ca734b80461cb5aa00cdb
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:2QvGAdlCEL8c/yRNw5Cgj2jF
TLSH
T158267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 43df4ebfbd87e4f2506a2749883937f544cf16beb8743a4362f351e9d0cbdf28
MD5 9e2746faaf55151506a9ed3a3cd5abbb
SHA1 e863bef9bf8b16db161d66727a49566670d88084
SHA512 fb8dcffbc7ec01701a0217182d5c394036555fb3b52f5572b3399ea23381ccf86c5b0cb77dd5b9e608343fc7cfc3f9b5886d7a8e5d55ca92d9f9e5ef3a6accfb
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAj0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:bdewsAj8dCN/j2GLl3iFSE33b9
TLSH
T19415E031FE74E036C27F0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ca131df12db4b586f4ba56a44a60f06c5e0384db74b56ce5266b3ec7d01e50ca
MD5 470426f4a17a8444505a7c2713d13a58
SHA1 9f73f532097062ad7f53738742e43c353ebfe10b
SHA512 405bcc0db5481d7a91eaba512885b755b869b489e877e7678dff76562393f0397d3e88d84e02011be989ec321ed590ab46efc5529b46c07cd0845b39fdc768cb
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHx8F:MUEtQevvqc2W1cpV2EI32x
TLSH
T108474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 789fc0a3f42c9e4ac5f6e2b367431c7ff3f3ff5edce475b71707be676177a256
MD5 25844961cf0b01b959467e256f1934bc
SHA1 8a6050a59178f9b56361dd4ba8c024cdcded1f7e
SHA512 845d9e6b12eb8929d0f5b1214922ca5beacb9deca3a0af58bc10fd44258e3555a3c026a4b308380379e503ac526b86cd3876f6a2d5c048819d7e710d00cdfe3d
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zHN/j2U4FH:ZoqtVjnmMj2jF
TLSH
T12ED58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 46c1e9fc29ed2ded62a2abf7c3348393407c36c545bfa3874f73a8d32714cfd3
MD5 b66cbe2a2b56d1d117824d6f03d41c91
SHA1 72d3e6f3608242a01ce669f3038a0dd54f26cf5e
SHA512 b51b3dfed9f36ac3a1aa5b760608f96f197443f82ea808ff474b5377d07c9bbb0633675e45de9550d57472c1795066ee6077d3f0629aed87abee93db1fca6654
SSDEEP 24576:vAhGLJIFoiwtA5l7S53zdCN/j2GLl3iFSE33b9:vAMyFoiq5gN/j2U4FH
TLSH
T18235AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 38a0edc9366c97eb696a2fbba4b945e78f058c902f124ea742aef71dc406b49e
MD5 fdb13a35c5c2464beb77dcbbcb871143
SHA1 48e7dd532be82de4ac8947a75c4b9a7993ec2fef
SHA512 3079301a4b52e673b86a1695f84a30f57559d8adaee63512e87c4bf65c318e76be3cd4f8992c4487b12e045553ef927867ee75cb403f441ff007ad1f56c61df0
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+C/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:owuoOWQdCN/j2GLl3iFSE33b9
TLSH
T19705F14577E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c7687ac2d012fba90a9613f4939a6062b079dcdfabf6b7a2f91188c477d013a8
MD5 5c0621d00631485436e2f200681a40ee
SHA1 84ddf91d3480856bcb0a574921efdb92eccc2316
SHA512 2e412b01e6e3c8f0cf5fd30d0875d6d2c075bd955968820bcb3ca324036f53f615a47ae12a70d16e29ff217c05e46cd4e3e5e7fb49ee36d32616ba1a3e375eba
SSDEEP 12288:JBZ1IykJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nZuBdCN/j2GLl3iFSE33b9
TLSH
T1C4E4125937E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a5b43d0b3e1dc705823e232717cbd6eb33d594522794a212e9e5d5c5d9b4fae5
MD5 72644af5fb061fa625bb1bd294b63b35
SHA1 14571765c31c48a928ba4b675d04e036f35851c7
SHA512 dcea35a40b00032546aa0f30257b4affd17dc1ed8e274a2f88043b19657ddaef12257d1f1d49fa880f80d25a59684e141c93a7a9f73403e363055fdfb10f390b
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:4QRQyi36YOcPQLvw2gAf+PN3jj2jF
TLSH
T1E0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 43afa76d126d8071f50f4672bf6d9a5a6eeaf78e2c11389def1d20281c3e5f4e
MD5 6f4e12765fe08fffb6cf515bfe6d1821
SHA1 229b45ba0fcccc66ce1dde2da259ced903e69314
SHA512 de19e819021917a53ed2a68197909b472191295920a278fffd2384ecafe0089382618fc257033e390e1490ad26817fcabe98f946a17fb41551189ff0e0199193
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:TQRQyi36YOcPQLvw2gAf+PN3jj2jF
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 df7bebb720e1d6e66cf4e0c4f729ffcf51bac3eb68441f601b571c11c067cb81
MD5 b93d546b5786ccd19beeb00c5e88fe09
SHA1 27a493f2ed6d35c8963f9cc877c68c639b93d652
SHA512 2a2e3f2d44ce94bba95b82c75b04344ead9e4829670e8be7cfe6ce04e872b6b48d7f91ab5123d558b2181d9b5baee14c54b2043097e069db55bf5efcb57a67f3
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xdCN/j2GLl3iFS+:c68Qg55nhheWu7PNU3/XN/j2U4FH
TLSH
T15BB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8541725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aca0d5bd91c0ff31f0f5994412fc3232a52b84685abec8d6f8c459b120c53315
MD5 ad62cfca2f752520283e95f659ce26c1
SHA1 04f8e03f83b5a18740c8c15931aa73347a86a79d
SHA512 640e5dc7d67e15e15526785e9355822b2793427cfdd2f9b365c91375bdbb11ae8ccfb343baac5f68980bcfbdd800128db36daaf492a581dd7f4bf7a995b4fe57
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:by5112gYy5azzVvL69nLKnhZ6j2jF
TLSH
T196168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4f7a8a523dfb1a3900b8bd880a46edec2b13697f963d508ae9667e9c115e541f
MD5 34607c37ffcdaf3623c3a4a063bba89d
SHA1 758c6c38ed495313e96deeaa4555b64a4349c45d
SHA512 c755c2c915f586063ddcf3f90480c4c0d10e9b9ecb4a2ac5e57b4be0974bd9d2b7d32aa31d2f46a24af74b31ca600a4b8de16257f73d137931137f352eef65a1
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/N/j2U4FH:Mu6JmVxd2dBj2jF
TLSH
T197D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ed8456ee1fc283c2e389455e17f05d765218da3adad3964983bd58be4dabd893
MD5 a697b8466fd44248f1dba57dc6bd64f5
SHA1 eb66b77354a4b10194183b6ee394830213e98c53
SHA512 74b5347504c381cd8dd45e6b7f513b636d99fadbea51a4afd86ea90b4186317c3f41c2a39500e74b009d5d54cebf16deaabb88beb42da787162f2ad29da30795
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4x5N/j2U4FH:YmifPbRMj2jF
TLSH
T189B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b1166e53fe648838e9706eaa2b41905c45129e55b639821be209762d13e23d30
MD5 e9c380e43dea0eb0125a0b9046664c6b
SHA1 e16f5d66bdd27c5373073fc341a48dd753aa6be9
SHA512 8a10e7b6f4d940def6afaceb95a67af76fbe58ae1ad95e46e385e06d48d0989ddb47337330df82434e010ce81812fb6bb1b9f5e5d67eea6bdfe769786d386371
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqWN/j2U4FH:y5dKTi61Oj2jF
TLSH
T186C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 97e7a6accf306efbc050d399edb16bf932bf201fc96b2723e2e4ea862c26d3fe
MD5 3ab3cd878584ee96337f5b9c75ac846b
SHA1 c2526224da3a42bb495ed6772eecf9ae8503ef46
SHA512 7a9c3747265fdf9236f4bc6d94fb5d1f52126a349216722b3ca1afa3aa7b083bbed583bf60f9a8619fb13a7a21a79798cde81b40ca229ff7f8eac6d61a27bd52
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5w1N/j2U4FH:kX2iyphYj2jF
TLSH
T19A95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 88e8657faba015784af3c5128888e6098646bf0d38fe9e44e533bcd1e02ea1ae
MD5 952fbd0ffe3b60d6e0058eba1d8a0e5e
SHA1 28a3724f1db7c24371825acf2f2b985f40d07ef0
SHA512 887a2320e4cc21ea9080022a220da5342ddb4218b5bd0654fa12356ca9db9d2862e70f1033de13091ad02aca2ed9e5e74acbadd47474b8499d3c4ead842b1616
SSDEEP 12288:r5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rddCN/j2GLl3iFSE33b9
TLSH
T17EC42364E9E6F669F15BC37D43A99B555200FEECF6264447828116EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 daeb0474132f3d1c0c9496681129890e2a3943a694d4fe14d83c04e83788c8e9
MD5 f768941c2bcf30f8e7b9f2c2ed3d5155
SHA1 cc916259657c63ec888f5ec32b1a162f99140777
SHA512 9d3c50ace85322abd2197690b68899a86efdf0bcf354bebb31522605d1e8c8cc2360da9ee5b1e076c8d200f4dcb1a1226b0ea63f83af649325476238ade8b1e4
SSDEEP 12288:w4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:w4dCN/j2GLl3iFSE33b9
TLSH
T14EC42364E9E6F669F11BC37D43A99B555200FEECF6224447868116EB637CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 692842c5cc1af4175cccd8df87116d569c53f70a86c9a9428e2158a151e42f5e
MD5 0ba0a0dd4d47d6b9bdb6d029f0cf25bb
SHA1 32092c1ebf9594bbd6ff5120ce615a4ac0b1907f
SHA512 50a9d48a6336e3d1340c8db00e412f6e412a6e35c7bae24e6cfa4d2e3d4189a0682d6960a1f9ddd59c195ec853cc55de26f4354a4159820748665045a638d6f5
SSDEEP 12288:4yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4udCN/j2GLl3iFSE33b9
TLSH
T184C42364E9E6F659F15AC37D43A99B555200FEECF626448786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b44cc272393d905d226ca26dda19c62509eb08d2cb1f9f895a4ae353751f19f6
MD5 4fa33f38b073560c765842e255660d56
SHA1 e50ef09383b917b83616a3f0d8d1f359ecc091cc
SHA512 5d4d4d80c57f2e80418695a9deec1daee01437d2c042f1d8825f52027b49abcee3a79f837db1cbee52680eebd65fddb9e8518f900bd25b3a8b867a7c351aac4d
SSDEEP 12288:rVLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RdCN/j2GLl3iFSE33b9
TLSH
T18AD42364ABF5A1D5E06BC37C83B59A11E320FDE8F732458F86400AEF1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 515d08cf998f5aaeae226ebbe2bf5c34ba27a95df7a8206291940fb59244965b
MD5 9bcf1c921edf20fc6d945a3453878cff
SHA1 9ab9e980c36b2cd1b0467b9125c070dc6f7fbdf5
SHA512 2f714ad7a460819380e366a52e928178a5fdf48b83bcc9668eeb1e27db7ed76183551ca72cc5bf32702b1a547c67a3cb8c1aa427e3237be813848c1d49251985
SSDEEP 12288:ujJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ubdCN/j2GLl3iFSE33b9
TLSH
T12AC42364E9E6F659F15EC37D43A99B555200FEECF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 1bada60cb03f87d6d654b0430b2e519a27f2f67a4fd711c16782ac95ea9921a7
MD5 2ec010dede91d2d705aed444c1e4f4cc
SHA1 7ff67dadd8be9bf2094f4eb3d8741c4e0b2164f2
SHA512 73bd4ebf0b558ca76c49bfc079ecc2a0401accea8fab2b8c5a6cba2870c9468481b19640e9554896e4502a977389be86dbc530e2229b59a53df748379573c56f
SSDEEP 12288:vcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vUdCN/j2GLl3iFSE33b9
TLSH
T16DC42364E9E6F669F11BC37D43A99B555200FEECF6264447868116EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bee4fa4613f9a6901db4afb7e2264219a38229616300a768278b693f80fefacc
MD5 e4e9da2b495675b1a01966476dc813a4
SHA1 4116ab8a7c65c89f1a4ca933f75d769d47f24eed
SHA512 9a290fd705221f593f82078d9272f37f8a91bfedafebc22d0a38bd872e000019753d00a8baa1a31e784236216510b9798125b7619044b2fa7a01ea294a5d9fe5
SSDEEP 12288:4wJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4AdCN/j2GLl3iFSE33b9
TLSH
T102C42364E9E6F669F11BC37D43A89B555200FEECF6264447868156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8ea0c67285c9aebb4c2c8cbcb19870605d9852394043f24306e9b16ff96d6680
MD5 0877e23f0068503fe4e8d92c263a76f2
SHA1 ff2a0b67603be4c6ed4dc91a0fb241237cd31139
SHA512 2d069943cc77b36bb317e9adeb5f6b8d8a58d009197b23eeded742aa5483e47f746d8328c0a6e49021208552ebeb22877a6a35a6ed7fc41a9af49b7761bdba21
SSDEEP 12288:miZwb6zzFEoS2cPvyYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pZMSzFVSOYdCN/j2GLl3iFSE33b9
TLSH
T1B00502A4B39058F8EC67823EC9658906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d8ff81887f63ea2c4435b0f40a7a351dc94ec5ab435be07613cdbd6e41bf991d
MD5 76ec8ab5804ebd0a20ed48a1b54db788
SHA1 486e3c1bc406d3935b18d026724438c8d51e0fd3
SHA512 0294c5c8277bc348871f2e2b9b54a38c2c3da4165c046501c64c7cea5f9de1d1c13e5b89c88a98992e47ea8cafb1590c9a4a5878373143b917497a044a5f15d9
SSDEEP 12288:l1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lRdCN/j2GLl3iFSE33b9
TLSH
T134C42364E9E5F659F15BC37D43A99B555200FEECF6224487868516EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 aeb9982c53a895e0e2aabbbed1b41a1dc2116412af2d409079b7958387df2630
MD5 746e0f86438f2a5f4adb98e632403d8a
SHA1 041400544866dfb6ce31cf5a37eaa98f2a4c6ce9
SHA512 aaa55dcdc3729d4b742099ba814627c2f173d6968f985ea2e31158fa0a089bf6c7c14b6d89ea27dc670169cc657d39cd1ba9868f1d3c01c93a5ebe70890e0230
SSDEEP 12288:QBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Q1dCN/j2GLl3iFSE33b9
TLSH
T126C42364E9E5F659F11AC37D43A99B555200FFECF626448786851AEB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3b7bfa56e841ee2da1b05faaa30ed2378459cdc84323876be0a787ee2b53e918
MD5 7d6946759380647429ee9c750f81717f
SHA1 a98113bd75c6c31e993b3f5c0139b15f3cbea0aa
SHA512 0540339fa6638a0b927f68c7bb73622f96e521354c4498a70f1c8cc009becb891a156a21c35a5c4fc583eb6a69a02a2b7812798f48d6494830c24e843bbef470
SSDEEP 12288:fyPz5L8kJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SzyMdCN/j2GLl3iFSE33b9
TLSH
T106F40217B7A131F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3f8023aa298bf8f43a1858a5f266c143fe3c5dd9b2038bc6f31d5c945b751bff
MD5 96dfbf6725cd39d7444272de2c4fffb6
SHA1 2f19db58346ca3e30ba00ee701d4b86917954d66
SHA512 c68ecc70b5b2270ba9886e50b5c79c817bed498a9aa85974f5635af12bc09e9758f3c11a444401ccf5082866334645d96161b8420b8cb59debed12da507784b5
SSDEEP 12288:d1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dRdCN/j2GLl3iFSE33b9
TLSH
T150C42364E9E6F659F15BC37D43A99B555200FEECF6224487868116EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9e0fad73261120bb95d849cd110bbcc222c1e0b0f7e8df82a1a5a0feef05bc54
MD5 6dd266de1ed95ed35da3ef4fcdc034b3
SHA1 437d0080fa4e442c5844c38c0f6e13c1f96f19f1
SHA512 891fb2b6a27047d43c18a43d8184f4ab013d103efdaa52227346197ad51c617627049742ff8971775ef8633e1f5f5c43d31b158127486b23c1cd758933110473
SSDEEP 12288:U1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:URdCN/j2GLl3iFSE33b9
TLSH
T1E1C42364E9E5F659F15BC37D43A99B555200FEECF6224487868516EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1794b14c35a3db991a15f7219790bf782188ba96602436c2dd3ae531c16ef52d
MD5 c927a540aa6787289abc85c3329b68d3
SHA1 0bd98d209cb71d2e268395631ef143a2ed5d5fa6
SHA512 365f1d7808c174a0ab83fff8bc705c3623b6dbaa3195e8c62518a9a325c2af38b1e30ba8d1d981903a934428b690f7575bd3daca273e6f6c96f2af26159e09bb
SSDEEP 12288:cyPz5L8kJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FzyMdCN/j2GLl3iFSE33b9
TLSH
T154F40217B7A131F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 4fb99cb700af0a4d05f5eef8290cb3b8aaabbd9f52fe213e9406c16716fd70db
MD5 79faf87aa244edbf9abcc1c368a99019
SHA1 7fc14e7a2e827287e46db0d06d49aab29253b3d9
SHA512 cf53f0ad2b4e061b4c4f69e9985071c36464ea4a5e8ca8f5e7a0696871e109e9820a4a11a54481ba2ab8bf07273f0d28868f1d7de8bb62bbc4b7ecf6751970db
SSDEEP 12288:hCd9eWYoaLHF3z0z04PDvhCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cTHaLl3z0zDedCN/j2GLl3iFSE33b9
TLSH
T1400502A4B39058F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 dbd061e9d2f66f313dc5842df14cbb3aaab7ff51bb3c776ed106c741146cd933
MD5 af21ec9ebf43b0c38f32bd593a622ce4
SHA1 d67e3cd825fecfce3b674fdb453ea43984127361
SHA512 7491168a33a39652596ac66f7d3d1d4748e7d76639c79135b7aef61b22ecf70e32b67568178c4dc65acafa622f7fc81dacda7d7666fb0ba9ee930a6d40bc576c
SSDEEP 12288:mi4e7+RdTfgwCHKy7GLbbdIv3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:m37d9CHKy7GZKdCN/j2GLl3iFSE33b9
TLSH
T1F825CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 35239191a7965fe1c8ba1cc947f43d815a81948218d68369e3d7756c1098f6a4
MD5 50a3d3fde6f3ac4d67f6cbb91fe6576f
SHA1 cc172989a99478b820b4c70d45da8ff52d8e4b05
SHA512 7e4b40a539d1a9eaf7b322dcd5cbeee1f1aa8f0b01fbf8aefab5cabe6d735dec5e8422e0c6f87b4c7ba7df19ff823aa66513a58e4966c47747d6fa6e2be6d5e8
SSDEEP 12288:kSJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kOdCN/j2GLl3iFSE33b9
TLSH
T1EEC42364E9E6F659F15EC37D43A99B555200FEECF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 858b859bea4150dde00a3980cb3d98ffb19b9685e55263b632ab36e285fafb3c
MD5 45289cde8444f67ed25f7f854f5184ea
SHA1 5057ca780e8a6faa492dd38969d4c3125eb842d2
SHA512 31fa48b0d7ee8477431465ec12a8e54663a8693e538828c77bcd7dc63c06b577a8e44b6547147001f621845469adecd472272e534ac0474d59eb865d2d11e36f
SSDEEP 12288:uEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:usdCN/j2GLl3iFSE33b9
TLSH
T161C42364E9E5F669F15FC3BD03A99B555200FEE8F626444786811AEB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 64932854f9f85d774da146814d82e821653b6e7e7bc6beca50ae6472de864975
MD5 0a2b1d5dd2af0b912afe4142024e428c
SHA1 4b0d5f1704fd29e17a5456b2d89f7915032fc241
SHA512 f54417083a4643f945f9eb3274d7e8d98e6b6f3c0015d9b789024e846b65b53e832b7f70d0ae35322de14d06b275a5a9b6a7e802bf289f20acfa56d9d148b41c
SSDEEP 12288:L3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LXdCN/j2GLl3iFSE33b9
TLSH
T120C42364E9E6F669F15AC37D43A99B555200FEECF626444786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ee3e984faaa830d8b128e9242983ece7ef71b063822976409165f896209eb077
MD5 c6dab03007308efec0c3f8f40bf9efe3
SHA1 e115be797bb962d9e323bce695dcf297631b607c
SHA512 0e8436f9f07dcfcea570fa82e04b1607e413fcca88105f0f417e46148cbe56860fa8319bcf93f521f780c639c12ba5d32b69f5228e50c5868ede5940c952f81b
SSDEEP 12288:h1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hRdCN/j2GLl3iFSE33b9
TLSH
T1DEC42364E9E6F659F15BC37D43A99B555200FEECF6224487868516EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 26b28ef6c884df1c072ba09fd08c8f582009dfd7e78b99fcaf154eac702ef014
MD5 5872c15bc0c4e956f1adfdd3b0bfbde5
SHA1 0970fdc880ccb7d22b73714e6d0da7a206b06060
SHA512 b10c6676b0bc9b3e8698d200c01111c1a5a628e6dc74346b5f385042b03718f8991a90320d55c37f66fe1a1c7073f27ee5a2489f2e6fc9aa2a5046dae40d0b88
SSDEEP 12288:0SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0OdCN/j2GLl3iFSE33b9
TLSH
T1F0C42364E9E6F669F15AC37D43A99B555200FEECF626444786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ccd950b48a7941f090b1cec8e0048ec5d4b4a1bd605606fabb8db11b654e7538
MD5 efbe80d5a01be729f9408f7ff005685f
SHA1 673d0efc7dff3bc10afb14060409f8811ca1b8a4
SHA512 3a939368a19cffd2ad220f6442eeade114d73e3411870f62ecd858262738586fd644eecb62e216ff4a332785868e00b50bab9c273e14daf1bcab9b83b3df6e4a
SSDEEP 12288:KtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:K5dCN/j2GLl3iFSE33b9
TLSH
T137C42364EDE6F659E15BC3BD43A99B515200FEECF626444786811AEB637CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 937b53ac2139e08b40ac592d55f52e4d27a1e3c6ff40b4c08ddc09ebaeaa1cc8
MD5 af76beb0c37b49128baecf3a6434a63c
SHA1 8b91d2118a72d4195d70e064dd13fdc21645744b
SHA512 9a740076fc04f9727472141022f07bb92467b94f804c0b9bb7fb7e32057b531e8cdd230c0669ee335203864ad70522af2bf5b2eab68bc6861a08071c295703e5
SSDEEP 12288:OjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ObdCN/j2GLl3iFSE33b9
TLSH
T11CC42364E9E6F659F15AC37D43A99B555200FEECF626444786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0ede7dd98ab59b23d10c5822f963d82dbc6217657f2e06d4ffdda913ad4ad00e
MD5 701d9192ad9b5ea4bf17bc7919962ed0
SHA1 45c9fa634a5596f7acb18598ccfa6022cc87764b
SHA512 0b71b87a96a5bf9edf769f9f9f3b8a69a8865c57458bf07dc11749efbbfd79f11479364566894957e3c61d64ee1f0b47c5f37925d990c6bc01358223fa935a1b
SSDEEP 24576:Tfwvok9RX6wkyAIFdCN/j2GLl3iFSE33b9:1MnYI6N/j2U4FH
TLSH
T14335D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c7b842d33732a8600d757c1109b032ceb97cd1046983f4ff96a88d51e7494249
MD5 1b4579ddcdc2febd3e2e15aff5b4fdad
SHA1 d08ddfa05aa2bcdf539e22b8347401edb4c14eb9
SHA512 ad75b77427ab60a58a6dc5ef81c484e1a6e4c149850c915b05b124b68d19ea70f9bd5aca7d3ec204a6f814474cfebb51f1a1010d02976ddbf1f455adc0aa27e7
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VN/j2U4FH:BySzPDj2jF
TLSH
T1A1067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ad3aea5ba0c2de9f7d7aef887347c5025da20630d8a1abf081fcf8c35c0c0cf0
MD5 8f4098618e61ac6f26c6884b07cfe77b
SHA1 d2fa644c57d0e3ea307e0036a2a8619965381aee
SHA512 f8b5f42520062bcfbc84d3301789fdf46dd57fdfeca21963fc91bbf40798b19d8bf0e187704a7d10877233acc24fa04827b8cb8f3cd16bce54b6ed609fa30e92
SSDEEP 24576:n47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYodCN/j2GLl3iFSE33b9:n47JUQj1irIhCnDHUPfF/lN/j2U4FH
TLSH
T1FC65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7d91e26d1430c2c3c0f68948089b0c7a87373fc904ea7f06010c8b519d5796cb
MD5 1f969390de66200de48c3483470707e1
SHA1 46ac4f892089319d1dbd629300fe1440ec64ed98
SHA512 e457ae8da0c51f9ef4a8ea98c8a8554bd9d1010ee15eddc964f4515b1b4066e69a607cc94b5a10dcfcc6c1eeff1cbe5a2864c8a17a488efbbe9f4f439de5fcb2
SSDEEP 12288:cNsfFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NBdCN/j2GLl3iFSE33b9
TLSH
T1BFE40119D29852E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6e40617cd4bc41c2b8acfed4bd9cad64ee94639cc3097a729c9be5234db1e6fd
MD5 f479eb119b678b999b8abc1397616064
SHA1 b8ddc28a8db035b82affe469452f64b02e2b3989
SHA512 d00404de1d5acfb020f8144dd022ca15846012b638ec4dc72948a637e14ffa1cb8eadb9fd76005562bc0d0ffe978eae6539c3bfad54709cadc7693098c0825a9
SSDEEP 12288:8YCFU3faxp9dy3JAA0sP4K/KwxOVo9BGqHCL7+hv:8YmUPYqAA0sPhX9BGqiL7gv
TLSH
T1273537117666CB4FC6A940325E33D2CCAB707D01EE44AB0373C9872FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 94de8e0b0ee5d376a363c13cc001a448d440bd887c4d0af012cd670070cf7a9a
MD5 708abc603c943fc87b34d7e42d87994b
SHA1 93aeceeb1e6660906cbb36dc7c7b7c82a6573c52
SHA512 cc7db5e8730c532613aa0c5e7b2af3eaac3c529e437d7c38c77cc0ce2ca40b1b3c4bf7d29c0cd5917a3718e712659e691e1779185b5c2ced3d573f50c53b9d27
SSDEEP 6144:XZCYYB8kAjgAF/WKbivalZduI19qYCFjfUzSB5vyUufUOSBRly+tMx2y+tMxo34F:UM5biwZdCYCFjfUzSB5vyUufUOSBkD+4
TLSH
T14D55E8405537E78FD1B76032072B9B4C67A4EC07B7096F26A3CA457AD86AB11B0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5c4fa0f756960f195bc43983d0fa2f8feb95c31ab328f7f5e1863ec65daa8d47
MD5 63770973fed3889699074cc84c51f2c9
SHA1 7d558d0e23ae85657b062ee37a873be254c8281b
SHA512 d3d84092e1acafdd7cc37a405c7139407ae35c933c1611ee54f8338b80d6c2259f00a2ac225faa8386f245ef47c67faeebded7a77f9e44fed3fc2bc0b8125909
SSDEEP 12288:EM79JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lpdCN/j2GLl3iFSE33b9
TLSH
T11DD42360DBE9FA55F07E837802ADDA256200FEF8DB1184C7C54126EB6278FD8C932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c1fda7e3f02d25a12ae45f8831def5c8ea9331fb7e3f1a8becf5e942a4297328
MD5 e8bac22a0c223e40d758747bffe44ab8
SHA1 ef10ee11cce228f7d6df2969198a88f19265fb7f
SHA512 e8bf89537f97e83a9ad7eda917b7811f63cb2be9d6498731ed841e7426cd13229aad0da3d3980e3499c7a2e1793cf2adec74f46e18c02722295f935f80e067f5
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYPdCN/j2GLl3iFSE33b9:Ugb4mBIBhGFTN/j2U4FH
TLSH
T12865AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3c1fb2960505465b4349b34fed50db641d9100f48f71d10ec7f5acf7851588b2
MD5 33c8f04d29532c7d51a3ce96324d6491
SHA1 cec1360f46f4fa6cf0eda2cbee1240b05778602b
SHA512 a372d73c6936df2ec7fbcef07785cd8aadfe4f012168e3e914a03698867a3b0c601ca4d34d4e627b13f3d684098774a8fcc682cf80cf409ed0e7e820084e8ea2
SSDEEP 24576:8G88u8FpJqH1bzria7/mYdCN/j2GLl3iFSE33b9:/7ZFPqVea7/kN/j2U4FH
TLSH
T14B35F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 f106d01f412cdfe77796e4ac2a84b6b57d2e26f989bec74ffcc5e2897c7e164c
MD5 d5b7f6fdf0922b7c1b4df26be38f4094
SHA1 7a20c0aae2595209efd0c526989a694ed38e7f9d
SHA512 547ef10c4075e6b64d8930cc684301c59e421c6ffc9b013f7b8069d7229a4938d7f41e72e373289fc9d1000eae16062830fac8f748a2a9ad49ff3b37c6b8b737
SSDEEP 12288:gHvUrBFrEjwaQMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gPUr+NQkdCN/j2GLl3iFSE33b9
TLSH
T17B05F22E66E818E5E67AD17D86868719F771B8615312D2CF02D0817F0F27EE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 966169516bfe769c309ddf5d6efee8f5756600ad11bcb0b7122c269c9638ec44
MD5 3c7a05ea20ce78ac2141f24666f44052
SHA1 2332e6df3117769e8545c86a7fc025cffefe0160
SHA512 d360bfa44c376b3c0589e5a9763403ce8225bff3419c1e6a03017317c1faf20a3ccef9083f1afba1cefa634404c424af5ecd64c22342b08833f5d3872a507d0e
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/N/j2U4FH:/G05lO43bSj2jF
TLSH
T19AD5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ddcc5d663cc5c49be1202f06ed68cc9f0826ae46d246164946694acc0dc81333
MD5 badc684b4ce99848d2a557499d00d5c9
SHA1 5bdd07e32d74043b5d79dc5f6e3cd3035ca93224
SHA512 c2d4b4df7b75808035b3d42f8679a960a23da79e15c880acdd0950521b0009a698e187653e5b37fae0ce18d7d5d6a179c11fbfa6aadf7bb22dcfe4c85cdd2d5c
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnSdCN/j2GLl3iFSE33b9:Da5POZ3+Jt2pasx2+mXN/j2U4FH
TLSH
T1DD65BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7b3563db8cbeb26cd77d86154c6825f4e0ed8cae195216017389ebda7f8cf42e
MD5 d6a6a7f8a2fc4c25b7e9fcc4768d638c
SHA1 0c0be62c4cf66e2c4472948b50111c307057cd6f
SHA512 a314ecd3acc23a777ca56e2a031ecdaa773d972e69fe774e6f8b2fe22a4571013b726ea0037b838b8d338e253de1ce47ce1c379b095ef4c507737bf5b2de8dfa
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkwdCN/j2GLl3iFSE33b9:4Nc/zEOVHFEN/j2U4FH
TLSH
T133857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6d80769ddffc4aab424529aed200125e27929d808da4120fbb5741a51e5dd1d6
MD5 2f47d6a7d7581559b5af27004c8fb9b2
SHA1 31016b6bdac03651f23adc7e274d388957958e44
SHA512 2abc7ffc6980f1606ebd3b284cd4aa92261456541d2617fa49333a07509762eaa10005730aa9d0f89818ab7708db92198ff96ab68bf9fa37e7deb487011143e9
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmQdCN/j2GLl3iFSE33b9:B8MwBtOmbN/j2U4FH
TLSH
T18255AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 05ce3427007fca5e80d20d1a11ba2a74bf9778ca9764dc1f1776129ca94d76f7
MD5 286b67d29d4ddf76bccf84a98d7cf32e
SHA1 39dcfa2274ea5d5d77a0b24809cffff5eeded95d
SHA512 eb284164d1b33ac36e9bc4b72920bd3666d0dfc98845c07716482d12869d9f104094b88ffbaa75e20748cb3c9eba1b3dffc4bdac227c8e946bb9764e5e87fa05
SSDEEP 24576:LD3FHshBIYQgA9dCN/j2GLl3iFSE33b9:LDVHeBIAASN/j2U4FH
TLSH
T1ED25E17DE69C04E4E57BC2BCC6638A06E77178AC432255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/956-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/956-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/956-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/956-337-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/956-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1888-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1888-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1888-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1888-172-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2076-55-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2076-37-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2076-36-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2076-43-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2076-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2592-323-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2592-322-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/2592-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2592-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2592-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3076-84-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3076-86-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/3076-90-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/3076-315-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3340-335-0x0000025417F10000-0x000002541819B000-memory.dmp

Download

memory/4676-127-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4676-318-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4676-121-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4676-120-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4780-300-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4780-72-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4780-74-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4780-80-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5104-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5104-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5104-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5104-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5428-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5428-140-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5428-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5428-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5428-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5848-28-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/5848-0-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/5848-7-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/5848-9-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/5848-1-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/5848-31-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/5960-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5960-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5960-114-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5960-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5960-319-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5960-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6028-68-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6028-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6028-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6028-285-0x0000000140000000-0x00000001400CF000-memory.dmp

Download